loongarch PackageIds Overflow

Vulnerability analysis

During boot, the LoongArch kernel parses the ACPI PPTT table to retrieve CPU package IDs and stores them in a fixed-size static array. On virtual machines configured with one core per socket, the number of packages can exceed the array's declared capacity, causing the kernel to write past the end of the array and corrupt adjacent memory. The fix enlarges the array to the maximum of the existing package limit and the KVM maximum VCPU count so that all valid configurations are covered. The vulnerable code path is reached only at boot when the kernel consumes firmware-supplied ACPI tables, so an attacker must already control those tables — either by operating the hypervisor on a LoongArch VM or by having root or physical access to modify firmware on a bare-metal LoongArch machine.